Privacy Notice

Please note: This Privacy Notice has been recently updated and the version below will take effect on 16th February 2025. You can view the current Privacy Notice or read a summary of the key changes.

Here at tiney, we take privacy rights seriously. We respect the privacy of all individuals we deal with, including our website visitors, childminders, families (including children) who use our services, suppliers, enquirers and anyone else we meet in our business.

This privacy notice sets out information about how we use, store and transfer personal data which we receive through our website tiney.co (the Site), through the tiney platform (the Platform, which we make available through the Site and through our app) or otherwise.

Personal data means any information about an individual from which that person can be identified. There are certain types of more sensitive personal data which require a higher level of protection, such as information about a person's health or sexual orientation (as further explained below).

We are a data controller in relation to that personal data, which means we determine the purposes and means of the processing of that personal data.

We or us means Tiney Limited, trading as tiney, a company registered in the United Kingdom under number 11194291 whose registered offices are at International House, 12 Constance Street, London, E16 2DQ. We are a registered childminder agency.

We have appointed a data protection officer (DPO), Edd Read, who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights (see below), please contact the DPO at data-protection@tiney.co.

We’ve broken this Notice down to make it easier to navigate depending on your relationship with us.

• Information for childminders who register with us, or apply to register with us (Childminders);

• Information for parents or guardians who may use our Site and App and engage Childminders;

• Information for anyone else who we might deal with (like suppliers, referrers, local authorities, journalists, or anyone who contacts us with general enquiries, or people just browsing the Site).

If your child is of reading age, and will be looked after by one of our registered Childminders, then we have a child-friendly privacy notice which is set out at the bottom of this Notice.

Finally – in some places in this Notice we refer to the GDPR, which is the main law setting out our legal obligations and your rights in relation to personal data (although other laws apply too, including the UK Data Protection Act 2018). That’s kind of a shorthand reference – technically there’s a European GDPR and a separate UK GDPR (which is the same wording as the EU one, just transposed into UK law as part of the Brexit arrangements), and some other subsidiary legislation as well.

When we say GDPR, we mean the UK law as transposed from the European one and then updated.

Summary

Full details are set out in the relevant sections of this Notice below, but keeping it brief:

• we normally receive your personal data from you, but sometimes it might be from a third party with whom we are mutually acquainted (e.g. other users of the Platform or a reference provider such as Ofsted);

• if you are a parent, then we will process personal data relating to your children. We’ve included information for you in the section for parents below, but there’s also a child-friendly privacy notice if your child is of reading age;

• we do not normally review personal data relating to children, but might do so if we have quality or safeguarding concerns or in case of emergency;

• we use your personal data to deliver our services, conduct our business, keep appropriate records and meet our legal obligations;

• we only provide your personal data to third parties for our business purposes or as permitted by law;

• we store personal data for specified periods; you have legal rights in relation to your personal data which you can exercise on request;

• the Sites use cookies; and

• you can contact us to enquire about any of the contents of this Notice.

Importantly, this Notice relates only to the personal data which we receive and use. If you’re a parent engaging a Childminder, then you will likely provide personal data to them relating to yourself and your family. The Childminder’s use of that personal data will be governed by your own contract with them and by any privacy notice issued by them (although where copies of that data are stored in the Platform we might be a data controller together with the Childminder in connection with those copies).

This Notice supplements (and its terms apply in addition to) any other terms of use or other terms and conditions agreed between you and us from time to time, including but not limited to our General Terms of Use. It is important that you read and retain this policy, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using that information and what your rights are under the data protection legislation.

By using our Platform, you acknowledge you have read and understood this privacy notice and agree to the collection and processing of your data as described below.

Direct marketing

We want to ensure that you are informed and aware of the best services and promotions that we can offer you. You will receive marketing communications from us if you have requested information from us or purchased services from us and you have not opted out of receiving the marketing.

We may also analyse your personal data to form a view about which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask to stop sending you marketing communications at any time by following the opt-out/unsubscribe links within any marketing communication sent to you or by contacting us at community@tiney.co.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to service availability notifications, order confirmations, updates to our terms and conditions, and checking that your contact details are correct.

TrustPilot Reviews

We may contact you via email to invite you to review any services and/or products you received from us in order to collect your feedback and improve our services and products (the “Purpose”). We use an external company, Trustpilot A/S (“Trustpilot”) (who acts as our data processor) to assist with sending our review invitation emails and collecting feedback on our behalf from people who have used our services. This means that we will share your name, email address and any reference number with Trustpilot for the Purpose. If you want to read more about how Trustpilot process your data, you can find their Privacy Policy here. We may also use such reviews in other promotional material and media for our advertising and promotional purposes. You can opt out of receiving review invitations at any time by following the unsubscribe link in those communications or by contacting us at any time.

Lookalike Audience Building

With your explicit consent, we may share your email address, with Facebook in encrypted (hashed) form to create Lookalike Audiences. This enables us to display relevant advertisements to individuals on Facebook who share similar characteristics or interests with our existing customers. Facebook uses this information only to match the data we provide with its user database and create audiences for our advertisements. It does not share your personal data with third parties or use it for purposes other than creating Lookalike Audiences on our behalf.

Providing your personal data to others

In the ordinary course of our business we will disclose some information to third parties like our suppliers or advisors. This section explains when we might share your personal data with others.

Our advisors. We may disclose your personal data to our insurers and/or professional advisers to take professional advice and manage legal disputes.

Disclosures designated by you. We may disclose your personal data to third parties designated by you, such as other users of the Platform (like when we liaise between parents and Childminders).

Our service providers. We may disclose personal data to our service providers or subcontractors in connection with the uses we’ve described above. For example, we may disclose:

• any personal data in our possession to suppliers which host the servers on which our data is stored (including GDrive cloud storage providers), or which host third-party platforms we use to deliver our webinars (such as Zoom and Google Meet), or which provide community forum software (such as Insided.com) or call recording software (such as Aircall), or customer support tools (such as Intercom), or call scheduling/booking facilities (such as Calendly), or internal project and product management tools (such as Shortcut, Trello, Notion, Miro and Incident-io), or design and content management providers (such as Contentful), or to data warehousing and data and service automation providers (such as Stitchdata, Parabola and Zapier), and to web behaviour tracking providers (such as Hotjar), and to providers that process feedback forms on our behalf (such as Google Forms), or to freelance staff (including community childminder coaches) whose duties involve handling the relevant personal data, and to secure email platforms used by local authorities (such as Egress);

• contact details to providers of email, CRM, email marketing or physical delivery/courier services (including AirTable and HubSpot, based outside the UK), and to SMS messaging platforms (such as Twilio) and to Shopify (an e-commerce platform located outside the UK that we use to facilitate order processing and payments for childminder supplies and tiney-branded kit) and to providers of e-commerce order fulfillment (such as Huboo), and to venues running our events if they require it, and to Tigerlily Training Ltd who provides first aid training to trainees and to enable the redemption of any first aid voucher code purchased by a childminder (note that they are responsible for processing your personal data in accordance with their own privacy policy, which we recommend you review before using their first aid training);

• login credentials to cloud-based authentication and authorization services (such as Auth0) to manage user login and secure access to our services;

• payment and transactions data to our payment processing and banking as a service providers (such as Stripe and Modulr) and to platforms for referrals and rewards (such as Tremendous), to local authorities (where we process funded placements in affiliation with them), to Shopify in connection with purchases made via our Site, and to providers of e-commerce order fulfillment (such as Huboo). Any student finance reference number for a childminder (a ‘CCG’) is also shared with the parent in order for the parent to link the child with the childminder;

• discovery data (such as answers to qualifying questions) to scheduling platforms such as Calendly (based outside the UK), and information collected through home visits to internal communication and collaboration platforms (such as Slack), and to field service and client management tools (such as Jobber), and responses to customer satisfaction surveys to business intelligence tools (such as Metabase);

• check data such as identification documents to providers of database management tools (such as AirTable) and to U-Check who acts as our third party processors and manager of DBS checks, and national insurance numbers may be shared with local authorities to enable them to perform funding eligibility checks;

• health data (childminder health declaration forms) may be shared with the childminder’s GP or nominated medical advisor and we may share childminder health data with RTW Plus Ltd (who provide practising GP and nurse clinicians to us) for their purposes in carrying out virtual health consultations with childminders, and to GPDQ (for their health check services);

• usage data to providers of analytics services; and

• information relating to our childminders, like correspondence, account or check data, to third parties who provide benefits for those childminders (for example, insurers such as BHSF and Morton Michel) or who provide check services (like criminal record, local authority or credit checks). We will share information relating to you (or as applicable other members of your household) for check services purposes only to the extent sufficient to identify you (such as your name, address and date of birth) so that they can check their own records in relation to you (or as applicable other members of your household).

We do not allow our data processors to use your personal data for their own purposes. We only permit them to use your personal data for specified purposes, in accordance with our instructions and applicable law.

Events

We may capture photographs and videos during events we run, which may include identifiable images of attendees. We process photos and videos to document the event, promote future events, and share highlights with attendees and the public. We rely on your consent to use your images for promotional purposes. Where consent is not obtained, we may rely on our legitimate interests to document the event, provided this does not override your rights and freedoms. You will be informed and given the option to provide or withhold consent for photography and videography during registration or upon entering the event. You may withdraw your consent at any time by contacting us at [insert contact details]. Images and videos may be shared publicly on our website and social media platforms.

Compliance

We may also disclose your personal data where necessary to comply with law (in particular if we become aware of any criminal activity or serious safeguarding concerns) including during emergency situations or where necessary to protect the safety of persons (for example we may need to share personal data with emergency services or social services).

Restructuring

If any part of our business is proposed to be sold or transferred, your personal data may be disclosed to the new owner or in connection with the relevant negotiations.

International transfers of your personal data

Some of the third parties to whom we may transfer your personal data, discussed above, may be located outside the UK and the EEA or may transfer your personal data to their own service providers located outside the UK and the EEA. If so, then we will ensure that transfers by our appointed data processors will only be made lawfully (e.g. to countries in respect of which the European Commission has made an "adequacy decision”, or with appropriate safeguards such as the use of standard clauses approved by the European Commission). You may contact us if you would like further information about these safeguards.

Personal data that you submit for publication on the Site or Platform or otherwise make visible to other users may be available, via the internet, to others around the world. We cannot prevent the use (or misuse) of such personal data by others.

Data security

We have put in place appropriate security measures to protect your personal data. These include (but are not necessarily limited to) encryption, access controls, regular software updates and patching, firewalls and anti-malware software, data backup and recovery plans. We also have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where required by law.

Unfortunately, no transmission or storage system can be guaranteed to be completely secure, and transmission of information via the internet is not completely secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us of the problem.

Retaining and deleting personal data

We don’t keep personal data any longer than is needed to fulfil the purposes for which we collected it in the first place, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. This section describes how we retain and delete personal data.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We comply with our legal obligations in relation to the retention and deletion of personal data, and in particular ensure that personal data that we process is not kept for longer than is necessary for the relevant purposes. We maintain a retention policy, details of which are available on request.

We may retain your personal data longer where necessary to comply with law or in connection with any legal claim.

Our use of cookies

We use cookies and similar technologies to recognise you, improve our Site and services and for tracking purposes. For more information about the cookies we use and how to change your cookie preferences, please see our cookie policy.

Your rights

It’s important that you know your rights in relation to your personal data. This section should help you understand and exercise your legal rights.

You have rights under data protection law – they are complex, and subject to exemptions, and you can read guidance from the Information Commissioner’s Office at https://ico.org.uk/ for a fuller explanation of your rights. In summary, though:

• the right to withdraw consent: where our processing is based on your consent (as described above) you have the right to withdraw that consent at any time by notifying us, in which case we will stop the relevant use;

• the right to access: you have the right to confirmation as to whether or not we process your personal data and, where we do, to access to the personal data, together with certain additional information;

• the right to rectification: you have the right to have any inaccurate or incomplete personal data about you rectified or completed;

• the right to erasure: in some circumstances you have the right to the erasure of your personal data (for example, if the personal data are no longer needed for the purposes for which they were processed or if the processing is for direct marketing purposes);

• the right to restrict processing: you have the right to restrict the processing of your personal data to limit its use. Where processing has been restricted, we may continue to store your personal data and will observe the restrictions on processing except to the extent permitted by law;

• the right to data portability: you have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;

• the right to object to processing: you have the right to object to our processing of your personal data on the basis of legitimate interests (discussed above) or for direct marketing purposes and if you do so we will stop processing your personal data except to the extent permitted by law;

• rights regarding automated decision-making (see below): you have the right to request an explanation of how the decision was made, contest the decision and provide additional information for reconsideration, and request that a human reviews the decision instead of relying solely on the automated process; and

• the right to complain to a supervisory authority: if you consider that our processing of your personal data is unlawful, you have a legal right to lodge a complaint at any time with the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Automated decision-making and profiling

We may carry out automated decision-making and profiling to evaluate a potential childminder’s health, qualifications and previous record to determine their suitability for the role. Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. Specifically, we use algorithms to analyse the answers you provide on these data points in the initial call booking form. This process is designed to ensure that applications are assessed fairly and consistently. The answers you provide in the form are automatically processed using predefined criteria to assess whether you meet the requirements for the role. If the results indicate that you do not meet the criteria, you may be informed that you are not suitable for the role at that early stage.

You will not be subject to decisions that will have a legal (or similarly significant) effect on you based solely on automated decision-making, unless we have a lawful basis for doing so. It is possible our processing of your data may significantly impact your employment opportunities, career progression and financial status, and may therefore constitute a significant effect under GDPR, meeting the criteria for automated decision-making. We rely on your explicit consent to conduct this processing, as required by law, unless the decision is necessary for the entry into, or performance of, a contract between you and us (i.e. for childminding services). Where we request your consent, we will provide clear information explaining that profiling will be provided, including its significance and the likely consequences.

We have implemented measures to safeguard your rights, freedoms, and legitimate interests, including periodic reviews of the automated decision-making process to ensure fairness, accuracy, and non-discrimination.

Exercising your rights

If you wish to exercise any of the rights set out above, please contact us at the contact details listed below (‘Contact Us’). You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Third Parties

The Site and App may contain links to third party websites and refer to third party service providers and other entities (including third party check providers such as DBS). If you follow a link to any third party website or deal with any third party referred to on the Sites, then they may have their own privacy and cookie policies, and we are not responsible for their use of any personal data which you may provide to them.

Amendments to this Notice and your duty to inform us of changes

We keep this Notice under regular review and may update it from time to time by publishing a new version on the Site and App. This version was last updated in January 2025. You should check occasionally to ensure you are happy with any changes to this Notice, although we may notify you of significant changes to this Notice using the contact details you have given us, to enable you to review the changes before they become effective. If you object to any changes, you may close your account. Any changes will become binding on you upon your first use of our Site or services after the changes have been implemented.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

Data protection registration

We are registered as a data controller with the UK Information Commissioner's Office. Our data protection registration number is ZA451440.

Contact Us

If you have any questions, comments or requests regarding this Privacy Notice or our use of any personal data you provide to us, please contact us at Tiney Limited, International House, 12 Constance Street, London, E16 2DQ or at data-protection@tiney.co

Last updated: 17th January 2025

Child-friendly privacy notice

Who are we?

We are tiney, a company which connects childminders with parents and guardians. We also provide an online platform which helps the childminder and parent or guardian make arrangements, make payments, and share information more easily when the childminder looks after the parent or guardian’s children.

We are registered as a childminder agency, which means we have to obey laws which apply to those sorts of agencies. Childminders also have to obey laws which apply to childminders.

If you have any questions about this notice you can contact us at data-protection@tiney.co – if you’re under 13 you should ask a parent or guardian to do this.

What is personal data?

“Personal data” means any information which relates to you. This could be your name or address, or it could be notes which relate to you (like a record of any allergies you may have, or your learning progress).

Why does tiney have your personal data?

We might receive personal data from your parent or guardian, or from the childminder who helps looks after you.

What personal data might tiney have?

We might have a few different kinds of personal data. Some of this is personal data which childminders are required to keep in order to comply with law. Our platform helps childminders and parents manage their childminding arrangements, and it’s helpful for that personal data to be stored on our platform. Some of this is personal data which might not be required by law, but which is useful to us when we provide our services connecting your parent or guardian and childminder. Here’s what we might have:

• Your name;

• Your date of birth;

• Your unique identifier;

• Your profile picture;

• Your address;

• Your language, gender and ethnicity;

• Your dietary requirements and health information, such as details of any allergies, treatments or special learning or physical requirements you may have;

• Details of your doctor;

• Details of any other educational settings you attend and contacts there;

• Details of any social worker you have;

• Details of your likes and dislikes, like favourite books, toys, interests or activities (or things you don’t like or want to do);

• Information relating to your parents or guardians, or friends or family members who have permission to drop you off and pick you up from your childminder, and who we would contact in an emergency;

• Records relating to your learning and other activities at your childminder, and when you were dropped off and picked up;

• Notes and messages which your parents or childminders might make or send on our platform, which might be about you;

• Photos which your parents or childminders might send each other through our platform, which might include you. If you or your parent or guardian have given consent for us, or for childminders, to do certain activities with you or to use photos for marketing, profile or journal purposes, we will have a record of that consent.

What do we do with your personal data, and why?

We mostly hold your personal data to help your childminder and parent or guardian make arrangements, make payments, and share information more easily when the childminder looks after you. Most of the time, we don’t look at that personal data ourselves because we don’t have any reason to. For example, if your parent sends a message to your childminder which says “Alex has a sore arm today, so please don’t do any physical exercise,” or if your childminder maintains a record of your allergies and emergency contact details, we won’t normally look at that information. However, we might review that information:

• if we have any reason to worry that childminding is not being conducted safely or properly. Because we are a registered childminder agency, we have to make sure that our childminders act properly. We also want to make sure that parents and guardians are happy with the childminding service.

• to help resolve any disagreements or questions between your parent or guardian and childminder.

• If there is an emergency. For instance we might need to check records relating to your health or who we can call in an emergency if you are hurt.

It is legal for us to hold and use this data for three main reasons:

• To comply with our legal obligations as a childminder agency.

• To provide our services and our platform to parents, guardians and childminders, which is useful to us (because that is what we do in our business) and to them (because our service is helpful to them). The childminder has to keep records to comply with their own obligations, and we help them manage that. The parents and guardians want to be able to set up and manage childminding arrangements easily, and we help them with that, too.

• If you or your parents have given consent (in relation to our use of photos, or some information relating to your health).

Where does your personal data go?

Your personal data will be shared between your parent or guardian and your childminder. We may also share it with companies who provide services to us, if needed for them to provide those services to us. Some of those companies might be located outside the UK, and even outside Europe. Finally, we may share personal data if we are required to by law.

How long do we keep your personal data?

We keep your personal data only as long as it is needed in order for us to use it for the purposes we’ve described. We have a detailed policy setting out different timings to delete different kinds of personal data.

Your rights. You and your parents or guardians both have the right to:

• be told how we use your personal data;

• ask to see the personal data we hold;

• ask us to change personal data if you think it is wrong;

• ask us to delete personal data when it’s not needed anymore;

• ask us to only use your personal data in certain ways; and

• complain to the regulator in charge of data handling in the UK, which is the ICO.

We have kept this notice short and clear. We have also provided a longer notice to your parent or guardian describing how we handle your personal data, and if you have any queries you can talk to them as well as us.

What to do if you have any questions:

If you have any questions, comments or requests regarding this Privacy Notice or our use of any of your personal data, please contact us at Tiney Limited, International House, 12 Constance Street, London, E16 2DQ or at data-protection@tiney.co, or by telephone at 020 4579 9034.

Last updated: 17th January 2025